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1 This action is in response to the communication filed on 12/12/2005. 

2 DETAILED ACTION 

3 Continued Examination Under 3 7 CFR 1.114 

4 A request for continued examination under 37 CFR 1.114, including the fee set forth in 

5 37 CFR 1 . 1 7(e), was filed in this application after final rejection. Since this application is 

6 eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1 .17(e) 

7 has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 

8 37 CFR 1.1 14. Applicant's submission filed on 12/12/2005 has been entered. 

9 Response to Arguments 

10 Applicants' arguments filed 12/12/2005 have been fully considered but they are not 

1 1 persuasive. Applicants' argue primarily that: 

12 a. Cozza and Hypponen did not disclose that the fingerprint data includes a number 

13 of program resource items specified within said resource data. 

14 b. Cozza and Hypponen did not disclose the fingerprint data including a flag 

15 indicating which data is included within said fingerprint data. 

16 Regarding applicants 5 argument a., that Cozza and Hypponen did not disclose that the 

17 fingerprint data includes a number of program resource items specified within said resource data, 

18 the examiner does not find the argument persuasive. Hypponen taught that file signatures should 

19 be used to detect viruses (See Hypponen Col. 3 Lines 14-25) and Cozza disclosed the files 

20 containing resource items (i.e. application code, icons, preferences, strings, templates) specified 

21 within resource data (i.e. resource fork) (See Cozza Col, 2 Paragraph 7). Therefore, in the 

22 combination, because the file contains the resource fork and resource items, and the signature is 
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1 taken of the file, the signature includes a number of resource items specified within the resource 

2 fork. As such, the combination meets this particular limitation. Therefore, the examiner does 

3 not find the argument persuasive. 

4 Regarding applicants' argument b., that Cozza and Hypponen did not disclose the 

5 fingerprint data including a flag indicating which data is included within said fingerprint data, 

6 the examiner does not find the argument persuasive. Column 3 of Cozza clearly indicated that a 

7 set of flags was used to indicate the result (which viruses were found in the file) of the scan. In 



8 the combination, the signature of the file is used to represent the file during comparison. 

9 Therefore, it is clear that in the combination the flags represent which viruses were identified in 
10 the signature. Therefore the combination of Cozza and Hypponen did disclose the fingerprint 



1 1 data including a flag indicating which data (viruses) is included within said fingerprint data, and 

12 therefore the examiner does not find the argument persuasive. 

13 Because the examiner does not find the argument persuasive, the prior art rejections 

14 presented in the final office action dated 6/10/2005 have been maintained. 
15 

16 Claims 1-3, 5-9, 11-12, 14-19, 21-25, 27-28, 30-35, 37-41, 43-44, 46-51, 53-57, 59-60, 

17 62-67, 69-73, 75-76, 78-83, 85-89, 91-92, and 94-96 have been examined, while claims 4, 10, 

18 13, 20, 26, 29, 36, 42, 45, 52, 58, 61, 68, 74, 77, 84, 90, and 93 have been cancelled. 

19 All objections and rejections not set forth below have been withdrawn. 

20 Claim Rejections - 35 USC § 112 

21 The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

22 The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 

23 subject matter which the applicant regards as his invention. 

24 
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1 Claims 1-3, 5-9, 11-12, 14-19, 21-25, 27-28, 30-35, 37-41, 43-44, 46-51, 53-57, 59-60, 

2 62-67, 69-73, 75-76, 78-83, 85-89, 91-92, and 94-96 are rejected under 35 U.S.C. 112, second 

3 paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject 

4 matter which applicant regards as the invention. 

5 Claims 1, 17, 33, 49, 65, and 81 recite the limitation "said fingerprint data" in the last 4 

6 lines. There is multiple antecedent basis for this limitation in the claim. It is unclear to which 

7 fingerprint data this is referring and therefore the ordinary person skilled in the art would not be 

8 able to determine the scope of the claim. Therefore, the claims are rejected for failing to 

9 particularly point out and distinctly claim the subject matter which the applicant regards as the 

10 invention. For the purposes of searching prior art, the examiner will assume these were referring 

1 1 to either of the fingerprint data. 

12 Claims 1,17, 33, 49, 65, and 81 recite the limitation "said resource data" in the 3 rd to last 

13 line. There is multiple antecedent basis for this limitation in the claim. It is unclear to which 

14 resource data this is referring and therefore the ordinary person skilled in the art would not be 

15 able to determine the scope of the claim. Therefore, the claims are rejected for failing to 

16 particularly point out and distinctly claim the subject matter which the applicant regards as the 

17 invention. For the purposes of searching prior art, the examiner will assume these were referring 

1 8 to either of the resource data. 

19 Claims 3, 19, 35, 51, 67, and 83 recite the limitation "said resource data". There is 

20 multiple antecedent basis for this limitation in the claim. It is unclear to which resource data this 

21 is referring and therefore the ordinary person skilled in the art would not be able to determine the 

22 scope of the claim. Therefore, the claims are rejected for failing to particularly point out and 
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1 distinctly claim the subject matter which the applicant regards as the invention. For the purposes 

2 of searching prior art, the examiner will assume these were referring to either of the resource 

3 data. 

4 Claims 6, 22, 38, 54, 70, and 86 recite the limitation "said resource data". There is 

5 multiple antecedent basis for this limitation in the claim. It is unclear to which resource data this 

6 is referring and therefore the ordinary person skilled in the art would not be able to determine the 

7 scope of the claim. Therefore, the claims are rejected for failing to particularly point out and 

8 distinctly claim the subject matter which the applicant regards as the invention. For the purposes 

9 of searching prior art, the examiner will assume these were referring to either of the resource 

10 data. 

1 1 Claims 7, 23, 39, 55, 71, and 87 recite the limitation "said resource data". There is 

12 multiple antecedent basis for this limitation in the claim. It is unclear to which resource data this 

13 is referring and therefore the ordinary person skilled in the art would not be able to determine the 

14 scope of the claim. Therefore, the claims are rejected for failing to particularly point out and 

15 distinctly claim the subject matter which the applicant regards as the invention. For the purposes 

16 of searching prior art, the examiner will assume these were referring to either of the resource 

17 data. 

1 8 Claims 8, 24, 40, 56, 72, and 88 recite the limitation "said resource data". There is 

19 multiple antecedent basis for this limitation in the claim. It is unclear to which resource data this 

20 is referring and therefore the ordinary person skilled in the art would not be able to determine the 

21 scope of the claim. Therefore, the claims are rejected for failing to particularly point out and 

22 distinctly claim the subject matter which the applicant regards as the invention. For the purposes 
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1 of searching prior art, the examiner will assume these were referring to either of the resource 

2 data. 

3 Claims 9, 25, 41, 57, 73, and 89 recite the limitation "said resource data". There is 

4 multiple antecedent basis for this limitation in the claim. It is unclear to which resource data this 

5 is referring and therefore the ordinary person skilled in the art would not be able to determine the 

6 scope of the claim. Therefore, the claims are rejected for failing to particularly point out and 

7 distinctly claim the subject matter which the applicant regards as the invention. For the purposes 

8 of searching prior art, the examiner will assume these were referring to either of the resource 

9 data. 

10 Claims 9, 25, 41, 57, 73, and 89 recite the limitation "said fingerprint data". There is 

1 1 multiple antecedent basis for this limitation in the claim. It is unclear to which fingerprint data 

12 this is referring and therefore the ordinary person skilled in the art would not be able to 

13 determine the scope of the claim. Therefore, the claims are rejected for failing to particularly 

14 point out and distinctly claim the subject matter which the applicant regards as the invention. 

1 5 For the purposes of searching prior art, the examiner will assume these were referring to either of 

16 the fingerprint data. 

17 Claims 1 1, 27, 43, 59, 75, and 91 recite the limitation "said resource data". There is 

1 8 multiple antecedent basis for this limitation in the claim. It is unclear to which resource data this 

19 is referring and therefore the ordinary person skilled in the art would not be able to determine the 

20 scope of the claim. Therefore, the claims are rejected for failing to particularly point out and 

21 distinctly claim the subject matter which the applicant regards as the invention. For the purposes 
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1 of searching prior art, the examiner will assume these were referring to either of the resource 

2 data. 

3 Claims 1 1, 27, 43, 59, 75, and 91 recite the limitation "said fingerprint data". There is 

4 multiple antecedent basis for this limitation in the claim. It is unclear to which fingerprint data 



5 this is referring and therefore the ordinary person skilled in the art would not be able to 

6 determine the scope of the claim. Therefore, the claims are rejected for failing to particularly 

7 point out and distinctly claim the subject matter which the applicant regards as the invention. 



8 For the purposes of searching prior art, the examiner will assume these were referring to either of 

9 the fingerprint data. 

10 Claims 12, 28, 44, 60, 76, and 92 recite the limitation "said fingerprint data". There is 

1 1 multiple antecedent basis for this limitation in the claim. It is unclear to which fingerprint data 

12 this is referring and therefore the ordinary person skilled in the art would not be able to 

13 determine the scope of the claim. Therefore, the claims are rejected for failing to particularly 



14 point out and distinctly claim the subject matter which the applicant regards as the invention. 

15 For the purposes of searching prior art, the examiner will assume these were referring to either of 

1 6 the fingerprint data. 



17 Any claim not specifically mentioned above has been rejected by virtue of its dependency 

18 to a specifically mentioned claim. 

1 9 Claim Rejections - 35 USC § 1 01 

20 35 U.S.C. 101 reads as follows: 

2 1 Whoever invents or discovers any new and usefiil process, machine, manufacture, or composition of matter, or 

22 any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 

23 requirements of this title. 

24 
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1 Claims 1-3, 5-9, 11-12, 14-19, 21-25, 27-28, and 30-32 are rejected under 35 U.S.C. 101 

2 because the claimed invention is directed to non-statutory subject matter. These claims are 

3 directed only to a "computer program product". A computer program product per se could 

4 simply be a computer program written on paper, which does not fall within any of the statutory 

5 categories of patentable subject matter. The specification does not provide any metes and 

6 bounds for a computer program product and therefore a reasonable interpretation of a computer 

7 program product would include a computer program written on paper. Therefore the claims are 

8 rejected for being directed towards non-statutory subject matter. See MPEP § 2106, 

9 Claim Rejections - 35 USC § 1 03 

10 The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

1 1 obviousness rejections set forth in this Office action: 

1 2 A patent may not be obtained though the invention is not identically disclosed or 

1 3 described as set forth in section 102 of this title, if the differences between the subject matter 

1 4 sought to be patented and the prior art are such that the subject matter as a whole would have 

1 5 been obvious at the time the invention was made to a person having ordinary skill in the art to 

1 6 which said subject matter pertains. Patentability shall not be negatived by the manner in which 

1 7 the invention was made. 
18 

19 Claims 1-3, 5, 9, 11-12, 14, 17-19, 21, 25, 27-28, 30, 33-35, 37, 41, 43-44, 46, 49-51, 53, 

20 57, 59-60, 62, 65-67, 69, 73, 75-76, 78, 81-83, 85, 89, 91-92, and 94 are rejected under 35 

21 U.S.C. 103(a) as being unpatentable over Cozza (US Patent Number 5,649,095), and further in 

22 view of Hypponen et al. (US Patent Number 6,577,920) hereinafter referred to as Hypponen. 

23 Regarding claims 1,17, 33, 49, 65, and 81, Cozza disclosed a system, method, and 

24 computer program product (See Cozza Claims and Col. 1 Lines 26-33) comprising a computer 

25 program operable to control a computer to detect a known computer program within a packed 
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1 computer file, said packed computer file being unpacked upon execution, said computer program 

2 comprising (See Cozza Abstract and Col. 3 Paragraph 6: resource data reading logic for reading 

3 resource data within said packed computer file (See Cozza Col. 6 Lines 21-23 and 29-34), said 

4 resource data specifying program resource items used by said known computer program (See 

5 Cozza Col. 2 Paragraph 7) and readable by a computer operating system without dependence 

6 upon which unpacking algorithm is used by said packed computer file (See Cozza Col. 6 

7 Paragraphs 2-3 wherein the compressed file is not decompressed in order to read the resource 

8 forks information); and resource data comparing logic for generating characteristics of said 

9 resource data (See Cozza Paragraph 1 Lines 58-65 wherein it was inherent that the characteristic 

10 data was generated in order for the data to have been compared) and for comparing said 

1 1 characteristics of said resource data with characteristics of resource data of said known computer 

12 program (See Cozza Col. 7 Lines 35-39 and Col. 1 Lines 58-65) and for detecting a match with 

13 said known computer program indicative of said packed computer file containing said known 

14 computer program (See Cozza Col. 7 Lines 35-39 and Col. 1 Lines 58-65), but Cozza failed to 

15 disclose wherein said resource data of said packed computer file is processed to generate 

16 fingerprint data and to compare said fingerprint data with fingerprint data of said known 

17 computer program; wherein said fingerprint data includes a number of program resource items 

18 specified within said resource data; or wherein said fingerprint data includes a flag indicating 

19 which data in included within said fingerprint data. However, Cozza did disclose the file 

20 including a number of program resource items specified within said resource data (See Cozza 

21 Col. 2 Paragraph 7), and a set of flags indicating what data was contained in the file (See Cozza 
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1 Col. 3), and comparing the resource data with resource data of a known program (See Cozza Col. 

2 1 Lines 58-65, Col. 6 Paragraph 3, and Col 7 Lines 35-40). 

3 Hypponen teaches a method of virus scanning in which signatures (fingerprint) of a file 

4 are created and compared to signatures of known infected files in order to detect viruses (See 

5 Hypponen Col. 3 Lines 14-25). 

6 It would have been obvious to the ordinary person skilled in the art at the time of 

7 invention to employ the teachings of Hypponen in the virus scanning of Cozza by creating a 

8 signature of the resources of the compressed file and comparing it to previous signatures. This 

9 would have been obvious because the ordinary person skilled in the art would have been 

10 motivated to scan the files as quickly as possible, without compromising security. It would have 

1 1 been obvious in this combination that because the file contains the resource fork and resource 

12 items, and the signature is taken of the file, the signature includes a number of resource items 

13 specified within the resource fork. It further would have been obvious that because the 

14 fingerprint data represented the file during comparison, and the flags of Cozza indicated the 

15 viruses found in the file, the fingerprint data would have included a flag indicating which data 

16 (viruses) was included within said fingerprint data. 

17 Regarding claims 2, 18, 34, 50, 66, and 82, Cozza and Hypponen disclosed that said 

18 known computer program is one of: a Trojan computer program; and a worm computer program 

19 (See Cozza Col. 1 Lines 22-32 and Col. 7 Lines 35-39). 

20 Regarding claims 3, 19, 35, 51, 67, and 83, Cozza and Hypponen disclosed that said 

21 resource data comparing logic is operable to compare said resource data with characteristics of a 
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1 plurality of known computer programs to detect if said packed computer program contains one of 

2 said plurality of known computer programs (See Cozza Col. 7 Lines 35-40). 

3 Regarding claims 5, 21, 37, 53, 69, and 85, Cozza and Hypponen disclosed that said 

4 program resource items used by said known computer program include one or more of: icon 

5 data; string data; dialog data; bitmap data; menu data; and language data (See Cozza Col. 2 

6 Paragraph 7). 

7 Regarding claims 9, 25, 41, 57, 73, and 89, the combination of Cozza and Hypponen 

8 disclosed the fingerprint data including a checksum (See Hypponen Col. 4 Lines 55-59) value 

9 calculated in dependence upon one or more of: a number of program resource items specified 

10 beneath each node within hierarchically arranged resource data; string names associated with 

1 1 program resource items within said resource data; and sizes of program resource items within 

12 said resource data (See Cozza Col. 5 Lines 1-9 wherein it would have been inherent that the size, 

13 or amount of data, the string names in the data, and the number of the resource items in that data 

14 would have effected the calculation of the checksum). 

15 Regarding claims 14, 30, 46, 62, 78, and 94, Cozza and Hypponen disclosed the 

16 checksum being SHA, which shifts after each operation (See Hypponen Col. 4 Lines 56-59). 

17 Regarding claims 1 1, 27, 43, 59, 75 and 91, the combination of Cozza and Hypponen 

18 disclosed that said fingerprint data includes a location within said resource data of an entry 

19 specifying a program resource item having a largest size (See Cozza Col. 6 Lines 29-45). 
20 

21 Claims 12, 28, 44, 60, 76, and 92 are rejected under 35 U.S.C. 103(a) as being 

22 unpatentable over the combination of Cozza and Hypponen as applied to claims 4, 20, 36, 52, 68, 
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1 and 84 above respectively, and further in view of Hodges et al. (US Patent Number 6,269,456) 

2 hereinafter referred to as Hodges. 

3 The combination of Cozza and Hypponen disclosed creating fingerprint data for detecting 

4 viruses (See rejection of claim 4 above), but failed to disclose providing a time of compilation in 

5 the fingerprint data. 

6 Hodges teaches that in a virus protection system, virus signature files can be 

7 automatically updated with new signatures when necessary, if a latest revision time is provided 

8 with the files (See Hodges Col. 2 Paragraph 6 and Col. 4 Paragraph 6). 

9 It would have been obvious to the ordinary person skilled in the art at the time of 

10 invention to employ the teachings of Hodges in the virus scanning system of Cozza and 

1 1 Hypponen by providing a time of revision with each signature. This would have been obvious 

12 because the ordinary person skilled in the art would have been motivated to ensure that the 

13 system was protected against the most recently discovered viruses. 

14 Claims 6-8, 15-16, 22-24, 31-32, 38-40, 47-48, 54-56, 63-64, 70-72, 79-80, 86-88, and 

15 95-96 are rejected under 35 U.S.C. 103(a) as being unpatentable over the combination of Cozza 

16 and Hypponen as applied to claims 1,17, 33, 49, 65, and 81 above, and further in view of Pietrek 

17 ("Peering Inside the PE: A Tour of the Win 32 Portable Executable"). 

18 Regarding claims 16, 32, 48, 64, 80, and 96, Cozza and Hypponen disclosed detecting a 

19 known computer program in a compressed computer file, the file including resource data (See 

20 rejection of claim 1 above), but failed to specifically name the Win32 PE file as one of these 

21 files. 
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1 Pietrek teaches that a Win32 PE file is an executable file which contains un-initialized 

2 code and resources, which when executed the code is initialized using the resources (See Pietrek 

3 Page 21 PE File Base Relocations). 

4 It would have been obvious to the ordinary person skilled in the art at the time of 

5 invention to employ the teachings of Pietrek in the virus detector of Cozza and Hypponen by 

6 allowing the scanning of Win32 PE files and their resources. This would have been obvious 

7 because the ordinary person skilled in the art would have been motivated to provide protection 

8 against Win32 PE files containing viruses. 

9 Regarding claims 6-8, 22-24, 38-40, 54-56, 70-72, and 86-88, the combination of Cozza, 

10 Hypponen and Pietrek disclosed specifying a storage location for each resource item as an offset, 

1 1 and the size of each resource (See Pietrek Page 20 Table 13 Offsets and Page 21 Fig. 14 

1 2 DWORD OffsetToData). 

13 Regarding claims 15, 31, 47, 63, 79, and 95, Cozza, Hypponen and Pietrek disclosed 

14 decompressing the computer program upon execution (See Pietrek Page 21 PE File Base 

15 Relocations). 

16 Conclusion 

17 Claims 1-3, 5-9, 11-12, 14-19, 21-25, 27-28, 30-35, 37-41, 43-44,46-51, 53-57, 59-60, 

18 62-67, 69-73, 75-76, 78-83, 85-89, 91-92, and 94-96 have been rejected, while claims 4, 10, 13, 

19 20, 26, 29, 36, 42, 45, 52, 58, 61, 68, 74, 77, 84, 90, and 93 have been cancelled. 

20 Any inquiry concerning this communication or earlier communications from the 

21 examiner should be directed to Matthew T. Henning whose telephone number is (571) 272-3790. 

22 The examiner can normally be reached on M-F 8-4. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 



2 supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 

3 organization where this application or proceeding is assigned is 571-273-8300. 



5 Application Information Retrieval (PAIR) system. Status information for published applications 

6 may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 

7 applications is available through Private PAIR only. For more information about the PAIR 

8 system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 

9 system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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